Privacy policy
Pursuant to the UK GDPR and the Data Protection Act 2018
1. Data Controller
The Data Controller for personal data collected through the website www.bbiscyclosholding.com is:
BBIS Cyclos Holding Ltd
5th Floor, 167-169 Great Portland Street
London, United Kingdom, W1W 5PF
Company Registration Number: 13887698
E-mail: info@bbiscyclos.com
Data Protection Officer (DPO): Daniele Brazzi
In his capacity as Chairman of the Company, Mr Brazzi has been designated as Data Protection Officer. To exercise the rights set out in this Privacy Policy or for any matter relating to the processing of personal data, he may be contacted at the email address indicated above.
2. Applicable Law
This Privacy Policy is drafted in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, applicable to the processing activities carried out by the Company, which is incorporated and headquartered in the United Kingdom. Where the website is accessed by users residing in the European Economic Area (EEA), the Company undertakes to ensure an adequate level of protection in accordance with Regulation (EU) 2016/679 (GDPR).
3. Data Collected and Purposes of Processing
3.1 Website browsing
When browsing the website, technical data necessary for its operation are collected automatically, including IP address, browser type, operating system, pages visited and access times. Such data are processed for IT security purposes, monitoring of website performance and improvement of the user experience.
Legal basis: legitimate interests of the Data Controller (Art. 6(1)(f) UK GDPR).
3.2 Contact form
Through the form available on the "Contact" page of the website, users may submit enquiries by voluntarily providing personal data such as first name, last name, email address and the content of their message. Such data are processed solely for the purpose of responding to the request received and, where applicable, following up on the commercial or professional relationship established.
Legal basis: performance of pre-contractual measures at the request of the data subject (Art. 6(1)(b) UK GDPR) and, where relevant, consent of the data subject (Art. 6(1)(a) UK GDPR).
3.3 Commercial communications and newsletter
Subject to the user's explicit consent, the contact details provided may be used to send commercial communications, institutional updates and newsletters relating to the activities and services of BBIS Cyclos Holding Ltd and the Group.
Legal basis: consent of the data subject (Art. 6(1)(a) UK GDPR). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.
3.4 Cookies and analytics tools
The website uses technical cookies necessary for its operation, as well as third-party analytical and tracking cookies (including tools such as Google Analytics) to collect aggregated information on website usage. For a full description of the cookies used, their purposes and how consent is managed, please refer to the Cookie Policy available on the website.
Legal basis: consent of the data subject for non-technical cookies (Art. 6(1)(a) UK GDPR); legitimate interests for strictly necessary cookies.
4. Processing Methods and Data Retention
Personal data are processed by electronic and manual means, applying appropriate technical and organisational measures to ensure their security, integrity and confidentiality, in accordance with the requirements of Art. 32 UK GDPR.
Data are retained for the period strictly necessary to fulfil the purposes for which they were collected:
Browsing data: up to 12 months.
Data collected via the contact form: up to 24 months from the conclusion of the correspondence, unless a longer retention period is required by legal or contractual obligations.
Data for commercial communications: until withdrawal of consent or a deletion request is received.
Upon expiry of the retention periods, data will be deleted or irreversibly anonymised.
5. Recipients and Data Transfers
Personal data may be disclosed to the following categories of recipients, strictly to the extent necessary to fulfil the purposes set out in this Policy:
Technical and IT service providers (e.g. hosting, CRM, email marketing platforms), acting as Data Processors pursuant to Art. 28 UK GDPR.
Legal, tax and professional advisors, where necessary to comply with legal obligations.
Public authorities and supervisory bodies, exclusively upon request and within the limits provided by applicable law.
Data are not sold or disclosed to third parties for their own marketing purposes without the prior consent of the data subject.
Where data are transferred to third countries outside the United Kingdom that do not benefit from an adequacy decision, the Data Controller undertakes to implement appropriate safeguards pursuant to Art. 46 UK GDPR (e.g. Standard Contractual Clauses or International Data Transfer Agreements – IDTAs).
6. Rights of Data Subjects
In accordance with Arts. 15–21 UK GDPR, data subjects have the right to:
Access: obtain confirmation of processing and a copy of their personal data.
Rectification: request the correction of inaccurate or incomplete data.
Erasure ("right to be forgotten"): request the deletion of their data, in the cases provided for by law.
Restriction of processing: request the suspension of processing in certain circumstances.
Data portability: receive their data in a structured, commonly used and machine-readable format.
Objection: object to processing based on legitimate interests, including profiling for direct marketing purposes.
Withdrawal of consent: withdraw consent at any time, without prejudice to the lawfulness of prior processing.
Requests may be submitted to info@bbiscyclos.com. The Data Controller will respond within 30 days of receipt, with a possible extension of a further 60 days in cases of particular complexity.
Data subjects also have the right to lodge a complaint with the supervisory authority in their country of residence. In the United Kingdom, the competent authority is the Information Commissioner's Office (ICO), reachable at www.ico.org.uk.
7. Cookie Policy
For detailed information on the cookies used by the website, their purposes, duration and consent management options, please refer to the Cookie Policy available in the dedicated section of the website.
8. Changes to this Privacy Policy
The Data Controller reserves the right to update this Privacy Policy at any time, in particular in the event of regulatory or technological changes. Any amendments will be published on the website with the date of the latest update indicated. Users are therefore encouraged to consult this page periodically.
Last updated: June 2026
1. Data Controller
The Data Controller for personal data collected through the website www.bbiscyclosholding.com is:
BBIS Cyclos Holding Ltd
5th Floor, 167-169 Great Portland Street
London, United Kingdom, W1W 5PF
Company Registration Number: 13887698
E-mail: info@bbiscyclos.com
Data Protection Officer (DPO): Daniele Brazzi
In his capacity as Chairman of the Company, Mr Brazzi has been designated as Data Protection Officer. To exercise the rights set out in this Privacy Policy or for any matter relating to the processing of personal data, he may be contacted at the email address indicated above.
2. Applicable Law
This Privacy Policy is drafted in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, applicable to the processing activities carried out by the Company, which is incorporated and headquartered in the United Kingdom. Where the website is accessed by users residing in the European Economic Area (EEA), the Company undertakes to ensure an adequate level of protection in accordance with Regulation (EU) 2016/679 (GDPR).
3. Data Collected and Purposes of Processing
3.1 Website browsing
When browsing the website, technical data necessary for its operation are collected automatically, including IP address, browser type, operating system, pages visited and access times. Such data are processed for IT security purposes, monitoring of website performance and improvement of the user experience.
Legal basis: legitimate interests of the Data Controller (Art. 6(1)(f) UK GDPR).
3.2 Contact form
Through the form available on the "Contact" page of the website, users may submit enquiries by voluntarily providing personal data such as first name, last name, email address and the content of their message. Such data are processed solely for the purpose of responding to the request received and, where applicable, following up on the commercial or professional relationship established.
Legal basis: performance of pre-contractual measures at the request of the data subject (Art. 6(1)(b) UK GDPR) and, where relevant, consent of the data subject (Art. 6(1)(a) UK GDPR).
3.3 Commercial communications and newsletter
Subject to the user's explicit consent, the contact details provided may be used to send commercial communications, institutional updates and newsletters relating to the activities and services of BBIS Cyclos Holding Ltd and the Group.
Legal basis: consent of the data subject (Art. 6(1)(a) UK GDPR). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.
3.4 Cookies and analytics tools
The website uses technical cookies necessary for its operation, as well as third-party analytical and tracking cookies (including tools such as Google Analytics) to collect aggregated information on website usage. For a full description of the cookies used, their purposes and how consent is managed, please refer to the Cookie Policy available on the website.
Legal basis: consent of the data subject for non-technical cookies (Art. 6(1)(a) UK GDPR); legitimate interests for strictly necessary cookies.
4. Processing Methods and Data Retention
Personal data are processed by electronic and manual means, applying appropriate technical and organisational measures to ensure their security, integrity and confidentiality, in accordance with the requirements of Art. 32 UK GDPR.
Data are retained for the period strictly necessary to fulfil the purposes for which they were collected:
Browsing data: up to 12 months.
Data collected via the contact form: up to 24 months from the conclusion of the correspondence, unless a longer retention period is required by legal or contractual obligations.
Data for commercial communications: until withdrawal of consent or a deletion request is received.
Upon expiry of the retention periods, data will be deleted or irreversibly anonymised.
5. Recipients and Data Transfers
Personal data may be disclosed to the following categories of recipients, strictly to the extent necessary to fulfil the purposes set out in this Policy:
Technical and IT service providers (e.g. hosting, CRM, email marketing platforms), acting as Data Processors pursuant to Art. 28 UK GDPR.
Legal, tax and professional advisors, where necessary to comply with legal obligations.
Public authorities and supervisory bodies, exclusively upon request and within the limits provided by applicable law.
Data are not sold or disclosed to third parties for their own marketing purposes without the prior consent of the data subject.
Where data are transferred to third countries outside the United Kingdom that do not benefit from an adequacy decision, the Data Controller undertakes to implement appropriate safeguards pursuant to Art. 46 UK GDPR (e.g. Standard Contractual Clauses or International Data Transfer Agreements – IDTAs).
6. Rights of Data Subjects
In accordance with Arts. 15–21 UK GDPR, data subjects have the right to:
Access: obtain confirmation of processing and a copy of their personal data.
Rectification: request the correction of inaccurate or incomplete data.
Erasure ("right to be forgotten"): request the deletion of their data, in the cases provided for by law.
Restriction of processing: request the suspension of processing in certain circumstances.
Data portability: receive their data in a structured, commonly used and machine-readable format.
Objection: object to processing based on legitimate interests, including profiling for direct marketing purposes.
Withdrawal of consent: withdraw consent at any time, without prejudice to the lawfulness of prior processing.
Requests may be submitted to info@bbiscyclos.com. The Data Controller will respond within 30 days of receipt, with a possible extension of a further 60 days in cases of particular complexity.
Data subjects also have the right to lodge a complaint with the supervisory authority in their country of residence. In the United Kingdom, the competent authority is the Information Commissioner's Office (ICO), reachable at www.ico.org.uk.
7. Cookie Policy
For detailed information on the cookies used by the website, their purposes, duration and consent management options, please refer to the Cookie Policy available in the dedicated section of the website.
8. Changes to this Privacy Policy
The Data Controller reserves the right to update this Privacy Policy at any time, in particular in the event of regulatory or technological changes. Any amendments will be published on the website with the date of the latest update indicated. Users are therefore encouraged to consult this page periodically.
Last updated: June 2026